How did you come to the conclusion that it's the file extension?
My guess is that the format of the nginx access logs and the Tomcat access logs is slightly different. Try using the grok debugger on one of your nginx log lines and on one of your tomcat log lines. Use the pattern from your config -- %{COMBINEDAPACHELOG}, and see what fields are parsed and see if there is a difference.